Tech counts: Deconstructing the campus technology asset audit

Tracking IT assets across a higher ed institution is tricky business. Depending on the college or university, it may be done by an internal audit group or IT, or a combination of both.

IT asset audits are important from a risk management perspective because they help schools track compliance with software licensing agreements, as well as state and federal requirements, and help them be more efficient.

“You can automate remediation and you can also understand the extent to which you have, or don’t need to have, site licenses for things,” says Susan Grajek, vice president of data, research, and analytics at Educause, referring to the process of applying security patches and updates automatically to fix a problem such as a software bug, security vulnerability, or gap in compliance.

Getting a handle on hardware and software assets isn’t difficult, but it is time consuming, and the number of schools performing technology asset audits is still relatively low.

Only 18 percent of higher ed institutions that responded to the Educause 2013 Core Data Survey have broadly deployed some type of asset and configuration management tool to track assets. One-quarter reported having deployed something “sparsely,” and 27 percent were in the planning stages. Another 15 percent said they were experimenting or considering deploying a tool.

Grajek believes many institutions may not conduct tech asset audits because of concerns about faculty reaction. “A lot of protected data tends to be on faculty machines and intruding on them is very, very sensitive,” she says. Still, a compelling reason to perform asset management audits is to ensure compliance with federal regulations, such as FERPA and PCI compliance, Grajek says.

Takeaways for technology asset audit success

Establish a business case for conducting the audit.

If you’re at a public institution, know your state’s audit requirements.

Consider barcoding your tech assets.

Determine whether the audit can be done internally or if it’s better to seek an outside consultant. (Hint: What’s right this time may not be best next time.)

At technology purchase time, look to virtualized servers and PCs as well as asset management tools, for easier asset tracking and upgrades.

Maximize site licensing opportunities and the coordination of equipment purchases.

And public education institutions really have no choice in the matter. If they receive federal funds—and most do—they are mandated by their states to conduct asset audits either annually or biannually on equipment that generally ranges in price from $1,000 to $5,000. “We have to be proper stewards of taxpayers’ money so we want to make sure we control our assets and are accountable,’’ says Becky Saylors, the manager of fixed assets and inventory services at Virginia Tech.

But what exactly do these audits involve, and what’s the best way to approach them?

Audit practice

Determining what level of audit to conduct is the first step, says Saylors. An unobtrusive method is to use campus network statistics to estimate how many devices and other pieces of technology equipment a school has and the types of operating systems being used—but these numbers are still estimates.

he more intrusive way to track assets is to install software on all machines or use a barcode system, which requires each piece of equipment to be physically touched by a staff member.

Adding a barcode sticker provides administrators with basic information about every physical asset. To get more granular information, Grajek says it’s also necessary to install software to find out what applications are on an individual machine and the licensing particulars.

Still, barcoding and using tagging software on computers, monitors, and servers are two of the most common auditing practices, says Casey Foulds, education relationship manager with AMX. Barcoding involves traditional barcodes that are used to incorporate different types of information into a database, while asset tagging is simply assigning a tag number associated with the serial number, description, and cost of the unit, adds Foulds, who was previously coordinator of classroom technology at Texas Woman’s University.

Installing asset software can also reveal vulnerabilities on these systems and indicate when IT needs to push out a fix or patch, says Grajek.

At Yale, where Grajek worked previously, the IT department saved several person hours by pushing out an automated fix instead of doing it manually.

Some of these fixes, she explains, are already automatically being updated via Windows or Apple updates, or from Adobe or Java, which fix critical vulnerabilities on a computer or device. “But there are some that maybe don’t have patches ready yet or aren’t being released automatically,” she says.

Hiring an outside firm for an audit is also a viable option, says Foulds—who says she believes alternating years with both is the ideal approach.

“Software to manage assets can cost anywhere from six figures to free, if you use open source software,” says Foulds. “A $50,000 one-time purchase seems to be the average cost for a midlevel software package with lifetime warranties and support.”

The cost of an outside consultant will depend on whether a school uses its existing database solutions or purchases new software to track its assets.

Moving to zero

Florida Atlantic University is required by the state to audit all technology, from software to huge servers, that costs $5,000 or more.

While that number is higher than the minimum cost required just a few years ago in Florida, the process was still challenging, says Mahesh Neelakanta, director of IT for the college of engineering and computer science.

Resources

Often, smaller equipment such as laptop computers would be tagged and not tracked due to staff reductions and changes in personnel, which resulted in equipment going missing, Neelakanta says.

These smaller items would also be moved from room to room and lab to lab on campus. IT staff would spend at least 50 percent of its time tracking items down, which sometimes took a week or two.

But today FAU has a secret weapon for improving the asset audit process: zero clients. Unlike thin clients, they don’t have operating systems and are built using custom firmware/hardware.

“Technology evolves so fast that what might have helped us solve a problem a year or two ago probably won’t matter two years from now because there will be a new technology,’’ Neelakanta says.

Right now, for example, he sees virtualization as the hot technology. Whereas all of the labs at Florida Atlantic had physical computers five years ago, today the university is using ViewSonic and Dell zero clients and has phased out PCs.

That means physical inventory has been greatly reduced and, instead, IT now tracks how many students are using virtualized desktops­—which cost in the $200 range and are not subject to the state audit requirement.

“Using virtualized desktops and zero clients has alleviated our load even more because we don’t have expensive items, so if something is lost or stolen it’s easy to replace,’’ says Neelakanta. “It’s not a significant hit on our budget.”

The change has allowed Florida Atlantic’s IT leader and staff to focus less on auditing and more on making the best technology solutions available to users, he says.

While audits are still a burden, installing and maintaining cheaper devices has enabled his department to concentrate on its core business of IT.

Tom Kemp, director of instructional technology and learning management at Ashland University discusses methods for assessment of instructional technology infrastructure, and planning for replacements and renovations.

Keeping tabs

Kirkwood Community College has an open campus, and officials are addressing asset audits by closely monitoring what equipment they have.

In the past, the Cedar Rapids, Iowa-based institution was unable to recover stolen laptops and other devices. Now, thanks to ITAM, an asset management tool with a Lojack-like feature, the institution has been able to recover 100 percent of stolen devices, some from as far away as Arizona.

ITAM, a cloud-based product from School Dude, “helps us understand what we’ve got out there in the field and how to manage a large fleet in a way that makes sense,” says Jon Neff, CIO and associate vice president for technology services at the college.

Having that information helps with audits of existing equipment, as well as in purchasing decisions, because officials can gain an accurate understanding of what hardware has been deployed and what software and OS (including version numbers) are used.

“This information allows you to ensure your fleet will have compatibility with new versions, which helps drive the purchasing cycle,” Neff says.

Like FAU, Kirkwood has virtualized its servers—which allows one server to host multiple systems.The institution has just starting virtualizing PCs. Still, its IT team has 4,000 physical desktops and laptops to track. ITAM allows for visibility into several pieces of information on devices, and administrators can customize what they want to see.

“If we want to make sure we’re using all Windows 7, we can go in and do a query on all the operating system types,’’ says Neff.

Computers are replaced on a four-year cycle. With ITAM, the college has saved thousands of dollars by not having to purchase 300 laptops in areas where classes can instead share laptop carts, he adds.

Officials review the actual usage of each asset in the school’s fleet to determine if a shared set of devices such as those on laptop carts would be more appropriate than a fixed device in a classroom setting, Neff explains.

“If usage percentage is low on the fixed devices and schedules will allow for it, we prefer to use shared laptop carts rather than deploy a fixed asset,” he says.

The audit software makes this review possible. Administrators will match that usage up with Kirkwood’s room utilization program and determine whether a device should be fixed or shared.

“Sometimes, in education, technology is seen as giving you an advantage, but we want it to be efficient too,’’ Neff explains. “We want to make sure each asset is used optimally.”

Decentralized…but centralized

Rochester Institute of Technology has nine individual colleges that act like their own businesses—except when it comes to purchasing IT equipment and licenses, which is done “holistically,” says Greg Reitz, assistant CIO of IT services. That is, his team will negotiate on a purchase as an enterprise agreement.

RIT’s internal auditing group conducts asset audits with the help of an asset tracking system. All equipment has barcodes and RIT tags, he explains. “The days are gone when you walk into a room and say, ‘Oh my goodness, what’s all this equipment?’ Because the network is centrally managed we see what’s going on with equipment, so there’s not a lot of surprises, which is nice.”

A campus IT group meets weekly to discuss tech and service-related issues and license renewals, he says. In addition, RIT engages its legal, procurement, and technology communities, as well as internal auditors, when it comes to renewals, depreciation, and asset inventory.

Decentralization has been probably the biggest challenge in terms of tracking assets, but having strong relationships across departments helps, Reitz says. “We can’t really do well without that.” For example, when Adobe recently changed its licensing model at renewal time, IT worked with everybody to ensure they got a good picture of demand beforehand.

“Before we renewed our Adobe contract, ... the team vetted out what it really means,’’ he says. “With the evolution of [the campus IT group], there’s just more and more teamwork … and common access to information.” That, he adds, has led to not overbuying technology and better leveraging of purchases.

Educause’s Gudjek agrees that, like with the Adobe example at RIT, higher ed institutions need to establish a business case for why they should conduct a tech asset audit and understand their use cases.

The most powerful asset audit examples that Gudjek sees involve containing costs through an understanding of the opportunities for site licensing and better centralizing or coordinating the purchase of equipment.

Audit advice

Neelakanta of Florida Atlantic University advises that institutions undertaking a technology asset audit make sure the team conducting it works closely with the people who do the actual tagging to ensure items are correctly tagged and described accurately.

In terms of deciding on the best asset management system to get the job done, Kirkwood Community College’s Neff advises checking a potential system’s core competencies and determining what type of information should be captured. Neff also suggests paying attention to how easily the asset management system can pull information, whether it has good reporting features and a nice interface, and if it can do ad-hoc reporting.

One of the things Virginia Tech administrators have learned as a result of doing technology audits is that, as Saylors puts it, “things move around a lot more than you really think. Just because you saw these computers and assets in a room today doesn’t mean they’re going to stay there. Inventory is only good for the time you’re in front of that asset.”